[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpJr5ZUKdaIe71Y8PKHcPqvugWCrVjcdyyCrGjeeNcPA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":65},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"e1960ab9-68ba-40c6-b6b6-787d184cac82","AKI (Estonia) - 2.1.-4\u002F26\u002F1106-2333-4","aki-estonia-2-1-4-26-1106-2333-4-275454","Created page with \"{{DPAdecisionBOX |Jurisdiction=Estonia |DPA-BG-Color= |DPAlogo=LogoEE.png |DPA_Abbrevation=AKI |DPA_With_Country=AKI (Estonia) |Case_Number_Name=2.1.-4\u002F26\u002F1106-2333-4 |ECLI= |Original_Source_Name_1=AKI |Original_Source_Link_1=https:\u002F\u002Fwww.aki.ee\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocuments\u002F2026-09\u002FEttekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas.pdf |Original_Source_Language_1=Estonian |Original_Source_Language__Code_1=ET |Original_Source_Name_2= |Original_Source_Link_2= |Orig...\" Show changes","The Estonian Data Protection Inspectorate (AKI) has ordered a website operator to implement safeguards for personal data republished from public registers. The website continued to display documents even after original authorities imposed access restrictions, and failed to adequately address data subject requests. The AKI found the operator lacked sufficient technical and organizational measures to comply with GDPR, particularly regarding the ongoing legal basis for processing and handling special categories of data.","Estonian DPA orders website to implement safeguards for republished public register documents.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AKI_(Estonia)_-_2.1.-4\u002F26\u002F1106-2333-4&diff=53185&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F6\u002F61\u002FLogoEE.png","2026-09-23T13:43:11+00:00","2026-09-23T14:00:17.726487+00:00",7,[17],{"name":18,"type":19},"AKI","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":64},[47],{"slug":48,"name":49,"problem":50,"products":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[52,58],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":53,"product_name":54,"url":56,"description":57},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":59,"product_name":60,"url":62,"description":63},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":66,"title":67,"body":68,"framework_refs":69,"framework_notes":82},"estonian-dpa-orders-website-to-add-safeguards-after-republishing-restricted-personal-data","Estonian DPA Orders Website to Add Safeguards After Republishing Restricted Personal Data","A website operator continued to display personal data sourced from public registers even after the originating authorities restricted access to that data, creating an ongoing GDPR violation. The operator failed to establish a lawful legal basis for continued processing and did not respond adequately to data subject requests, compounding the breach. This case highlights that republishing publicly available data does not exempt an operator from GDPR obligations, and that access restrictions imposed by source authorities must be honoured downstream. Special category data carries heightened obligations, meaning the absence of technical and organisational controls exposes operators to significant regulatory risk.",[70,71,72,73,74,75,76,77,78,79,80,81],"GDPR Article 5 (Principles of data processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 9 (Special categories of personal data)","GDPR Article 12–17 (Data subject rights)","GDPR Article 24 (Responsibility of the controller)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 30 (Records of processing activities)","NIST Privacy Framework PR.DS-P4 (Data processing permissions)","NIST SP 800-53 AC-3 (Access Enforcement)","CIS Control 3 (Data Protection)","CIS Control 14 (Security Awareness and Skills Training)","ISO\u002FIEC 27001:2022 Annex A 5.34 (Privacy and protection of personal data)",{}]